Commit d48c896c authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge tag 'for-net-2026-01-22' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth 

Luiz Augusto von Dentz says:

====================
bluetooth pull request for net:

 - hci_uart: fix null-ptr-deref in hci_uart_write_work
 - MGMT: Fix memory leak in set_ssp_complete

* tag 'for-net-2026-01-22' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:
  Bluetooth: MGMT: Fix memory leak in set_ssp_complete
  Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work
====================

Link: https://patch.msgid.link/20260122200751.2950279-1-luiz.dentz@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents deb5c201 1b9c17fd

drivers/bluetooth/hci_ldisc.c

+2 −2
Original line number Diff line number Diff line
@@ -685,6 +685,8 @@ static int hci_uart_register_dev(struct hci_uart *hu) 
		return err;

	}



	set_bit(HCI_UART_PROTO_INIT, &hu->flags);



	if (test_bit(HCI_UART_INIT_PENDING, &hu->hdev_flags))

		return 0;
@@ -712,8 +714,6 @@ static int hci_uart_set_proto(struct hci_uart *hu, int id) 


	hu->proto = p;



	set_bit(HCI_UART_PROTO_INIT, &hu->flags);



	err = hci_uart_register_dev(hu);

	if (err) {

		return err;

net/bluetooth/mgmt.c

+3 −0
Original line number Diff line number Diff line
@@ -1966,6 +1966,7 @@ static void set_ssp_complete(struct hci_dev *hdev, void *data, int err) 
		}



		mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err);

		mgmt_pending_free(cmd);

		return;

	}
@@ -1984,6 +1985,7 @@ static void set_ssp_complete(struct hci_dev *hdev, void *data, int err) 
		sock_put(match.sk);



	hci_update_eir_sync(hdev);

	mgmt_pending_free(cmd);

}



static int set_ssp_sync(struct hci_dev *hdev, void *data)
@@ -6438,6 +6440,7 @@ static void set_advertising_complete(struct hci_dev *hdev, void *data, int err) 
		hci_dev_clear_flag(hdev, HCI_ADVERTISING);



	settings_rsp(cmd, &match);

	mgmt_pending_free(cmd);



	new_settings(hdev, match.sk);